that is what i was thinking as well so i removed that line but that caused all responses to internal traffic to be blocked. What do you exactly mean by specific? Wouldn't I have to put a rule for each type of traffic?
--- On Wed, 12/23/09, Adam Strawson <[email protected]> wrote: From: Adam Strawson <[email protected]> Subject: Re: [c-nsp] Port 1720 & 1863 To: "abs" <[email protected]> Cc: [email protected] Date: Wednesday, December 23, 2009, 5:41 AM Do you really need "permit tcp any any established" or can you be more specific? I'd bet that is causing what you are seeing. Adam. ----- Original Message ----- From: "abs" <[email protected]> To: "Steve Bertrand" <[email protected]>; "Jared Mauch" <[email protected]> Cc: <[email protected]> Sent: Wednesday, December 23, 2009 12:02 AM Subject: Re: [c-nsp] Port 1720 & 1863 i tried what you mentioned that did not seem to close the port. i also tried the following in the config but that didn't seem to work either: voice service voip shutdown any other thoughts? --- On Tue, 12/22/09, Jared Mauch <[email protected]> wrote: From: Jared Mauch <[email protected]> Subject: Re: [c-nsp] Port 1720 & 1863 To: "Steve Bertrand" <[email protected]> Cc: "abs" <[email protected]>, [email protected] Date: Tuesday, December 22, 2009, 6:38 PM You can close h.323 (1720) with a config like: ! voice service voip h323 call service stop ! - Jared On Dec 22, 2009, at 6:34 PM, Steve Bertrand wrote: > abs wrote: > >> ip access-list extended WANInBoundACL >> permit udp any range bootps bootpc any range bootps bootpc >> permit tcp any any established >> permit udp any eq domain any >> permit tcp any any eq 22 >> deny ip any any log >> >> When I run a port scan I see port 1720 as well as port 1863 open. Port 1863 >> tends to open and close at random (don't understand why). I realize that I >> may need to add an explicit entry in the ACL's for port 1720 as the service >> runs by default given the version of IOS that I am running. >> >> What I am failing to understand is why the above 2 ports are open even >> though I have a deny all statement at the end of the ACL. Am I >> misunderstanding something? Would someone be able to point me in the right >> direction? Thank you in advance. > > What interface do you have this ACL applied on, and how is it applied? > > Further, where are you scanning from (connected to which interface), and > which address are you scanning? ie. are you scanning the IP address of > the interface itself, or an address behind the interface the ACL is > applied against? > > Is your scan UDP or TCP? > > Steve > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
